Changeset 0a49bd7 for fedd/federation/access.py

Timestamp:

Jan 15, 2011 5:52:15 PM (14 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

aaf7f41

Parents:

ac15159 (diff), 944b746 (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.

git-author:

Ted Faber <faber@…> (01/15/11 17:51:40)

git-committer:

Ted Faber <faber@…> (01/15/11 17:52:15)

Message:

merge from current

File:

• fedd/federation/access.py (modified) (5 diffs)

fedd/federation/access.py

@@ -234 +234 @@
                         "Unpickling failed: %s") % e)
 
+    def append_allocation_authorization(self, aid, attrs, 
+            need_state_lock=False, write_state_file=False, state_attr='state'):
+        """
+        Append the authorization information to system state.  By default we
+        assume this is called with the state lock and with a write of the state
+        file in the near future, need_state_lock and write_state_file can
+        override this.  The state_attr is the attribute in the access class
+        that holds the per allocation information.  Some complex classes use
+        different names for the dict.
+        """
+
+        for p, a in attrs:
+            self.auth.set_attribute(p, a)
+        self.auth.save()
+
+        if need_state_lock: self.state_lock.acquire()
+        d = getattr(self, state_attr)
+        if aid in d and 'auth' in d[aid]:
+            d[aid]['auth'].update(attrs)
+        if write_state_file: self.write_state()
+        if need_state_lock: self.state_lock.release()
+
+    def clear_allocation_authorization(self, aid, need_state_lock=False,
+            write_state_file=False, state_attr='state'):
+        """
+        Attrs is a set of attribute principal pairs that need to be removed
+        from the authenticator.  Remove them and save the authenticator.  See
+        append_allocation_authorization for the various overrides.
+        """
+
+        if need_state_lock: self.state_lock.acquire()
+        d = getattr(self, state_attr)
+        if aid in d and 'auth' in d[aid]:
+            for p, a in d[aid]['auth']:
+                self.auth.unset_attribute(p, a)
+            d[aid]['auth'] = set()
+        if write_state_file: self.write_state()
+        if need_state_lock: self.state_lock.release()
+        self.auth.save()
+
     def lookup_access(self, req, fid, filter=None, compare=None): 
         """
@@ -261 +301 @@
         # Check every attribute that we know how to map and take the first
         # success.
+        fail_proofs = [ ]
         for attr in check:
-            if self.auth.check_attribute(fid, attr.attr):
+            access_ok, proof = self.auth.check_attribute(fid, attr.attr,
+                    with_proof=True)
+            if access_ok:
                 self.log.debug("Access succeeded for %s %s" % (attr.attr, fid))
                 # XXX: needs to deal with dynamics
                 return copy.copy(attr.value), (False, False, False), \
-                        [ fid ]
+                        [ fid ], proof
             else:
+                fail_proofs.append(proof)
                 self.log.debug("Access failed for %s %s" % (attr.attr, fid))
         else:
-            raise service_error(service_error.access, "Access denied")
+            raise service_error(service_error.access, "Access denied",
+                    proof=fail_proofs)
 
 
@@ -408 +453 @@
         return (exp, state)
 
-    def build_access_response(self, alloc_id, ap, services):
+    def build_access_response(self, alloc_id, ap, services, proof):
         """
         Create the SOAP response.
@@ -421 +466 @@
         msg = { 
                 'allocID': alloc_id,
+                'proof': proof.to_dict(),
                 'fedAttr': [
                     { 'attribute': 'domain', 'value': self.domain } , 
@@ -730 +776 @@
         except EnvironmentError, e:
             self.log.error("Error deleting directory tree in %s" % e);
+
+    def RequestAccess(self, req, fid):
+        """
+        Handle an access request.  Success here maps the requester into the
+        local access control space and establishes state about that user keyed
+        to a fedid.  We also save a copy of the certificate underlying that
+        fedid so this allocation can access configuration information and
+        shared parameters on the experiment controller.
+        """
+
+        # The dance to get into the request body
+        if req.has_key('RequestAccessRequestBody'):
+            req = req['RequestAccessRequestBody']
+        else:
+            raise service_error(service_error.req, "No request!?")
+
+        # Base class lookup routine.  If this fails, it throws a service
+        # exception denying access that triggers a fault response back to the
+        # caller.
+        found, match, owners, proof = self.lookup_access(req, fid)
+        self.log.info(
+                "[RequestAccess] Access granted to %s with local creds %s" % \
+                (match, found))
+        # Make a fedid for this allocation
+        allocID, alloc_cert = generate_fedid(subj="alloc", log=self.log)
+        aid = unicode(allocID)
+
+        # Store the data about this allocation: 
+        self.state_lock.acquire()
+        self.state[aid] = { }
+        self.state[aid]['user'] = found
+        self.state[aid]['owners'] = owners
+        self.state[aid]['auth'] = set()
+        # Authorize the creating fedid and the principal representing the
+        # allocation to manipulate it.
+        self.append_allocation_authorization(aid, 
+                ((fid, allocID), (allocID, allocID)))
+        self.write_state()
+        self.state_lock.release()
+
+        # Create a directory to stash the certificate in, ans stash it.
+        try:
+            f = open("%s/%s.pem" % (self.certdir, aid), "w")
+            print >>f, alloc_cert
+            f.close()
+        except EnvironmentError, e:
+            raise service_error(service_error.internal, 
+                    "Can't open %s/%s : %s" % (self.certdir, aid, e))
+        self.log.debug('[RequestAccess] Returning allocation ID: %s' % allocID)
+        return { 'allocID': { 'fedid': allocID }, 'proof': proof.to_dict() }
+
+    def ReleaseAccess(self, req, fid):
+        """
+        Release the allocation granted earlier.  Access to the allocation is
+        checked and if valid, the state and cached certificate are destroyed.
+        """
+        # The dance to get into the request body
+        if req.has_key('ReleaseAccessRequestBody'):
+            req = req['ReleaseAccessRequestBody']
+        else:
+            raise service_error(service_error.req, "No request!?")
+
+        # Pull a key out of the request.  One can request to delete an
+        # allocation by a local human readable name or by a fedid.  This finds
+        # both choices.
+        try:
+            if 'localname' in req['allocID']:
+                auth_attr = aid = req['allocID']['localname']
+            elif 'fedid' in req['allocID']:
+                aid = unicode(req['allocID']['fedid'])
+                auth_attr = req['allocID']['fedid']
+            else:
+                raise service_error(service_error.req,
+                        "Only localnames and fedids are understood")
+        except KeyError:
+            raise service_error(service_error.req, "Badly formed request")
+
+        self.log.debug("[ReleaseAccess] deallocation requested for %s", aid)
+        #  Confirm access
+        access_ok, proof = self.auth.check_attribute(fid, auth_attr, 
+                with_proof=True)
+        if not access_ok:
+            self.log.debug("[ReleaseAccess] deallocation denied for %s", aid)
+            raise service_error(service_error.access, "Access Denied",
+                    proof=proof)
+
+        # If there is an allocation in the state, delete it.  Note the locking.
+        self.state_lock.acquire()
+        if aid in self.state:
+            self.log.debug("[ReleaseAccess] Found allocation for %s" %aid)
+            self.clear_allocation_authorization(aid)
+            del self.state[aid]
+            self.write_state()
+            self.state_lock.release()
+            # And remove the access cert
+            cf = "%s/%s.pem" % (self.certdir, aid)
+            self.log.debug("[ReleaseAccess] Removing %s" % cf)
+            os.remove(cf)
+            return { 'allocID': req['allocID'], 'proof': proof.to_dict() } 
+        else:
+            self.state_lock.release()
+            raise service_error(service_error.req, "No such allocation")